[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: load balancer with SSL

To: Jeremiah Martell <inlovewithgod@gmail.com>
Subject: Re: load balancer with SSL
From: Aaron Richton <richton@nbcs.rutgers.edu>
Date: Fri, 9 Jun 2006 10:28:34 -0400 (EDT)
Cc: OpenLDAP Software List <OpenLDAP-software@OpenLDAP.org>
In-reply-to: <233eb300606090658i1f5fa8bfx940f6f3d185aadbf@mail.gmail.com>
References: <233eb300604240755n531cf8e2vbca23c8e476a2938@mail.gmail.com> <1145892082.5875.8.camel@zephyr.internal.amnh.org> <233eb300604261246h4778ba91tc6ea9fa53a4d7bb4@mail.gmail.com> <1146083365.6026.9.camel@zephyr.internal.amnh.org> <233eb300604270446m4c1a2c12hb1fefbafe41e3cdb@mail.gmail.com> <233eb300606090658i1f5fa8bfx940f6f3d185aadbf@mail.gmail.com>

My ldap.conf(5) man page says:

"If a bad certificate is provided, it will be ignored and the session
proceeds normally."

I believe that hostname != CN would be considered a "bad certificate." The
bad certificate will be ignored if "allow" is set, and the session will
proceed "normally" without TLS. You could verify this (or prove me wrong)
with security tls_ssf=1 or similar.

On Fri, 9 Jun 2006, Jeremiah Martell wrote:

> I actually had the TLS_REQCERT set to allow, not never, would this
> make a difference? The error I'm getting is "TLS: hostname
> (1.example.com) does not match common name in certificate
> (2.example.com)." I thought "allow" would keep this error from
> happening.

References:
- Re: load balancer with SSL
  - From: "Jeremiah Martell" <inlovewithgod@gmail.com>

Prev by Date: Re: load balancer with SSL
Next by Date: Re: load balancer with SSL
Index(es):
- Chronological
- Thread